skysight-inc/HackerNews huggingface dataset:
So every company who uses VPNs to allow their people to get into the network from offsite (customer site, airport, hotel) now can't safely?

You basically have to trust everyone on the remote LAN to not act like a malicious DHCP server.

Reading the other thread, this wouldn't even be just the gateway.. Sounds bad!
Stanley Kubrick was one of that kind of people who cannot take criticism of anything they do.
Elevate – Free Tailwind Business Template
Thanks for the link, that is a really nice paper!

I found it really refreshing that they report a bunch of stuff they tried that didn’t work in a way that clarifies the problem and leads to a lot of insight into the strengths and limitations of their final method and the leading alternatives
Don't know what the parent poster thinks, but what is happening is this:

https://workspaceupdates.googleblog.com/2023/09/winding-down...

Which means that basically only apps that are approved by Google for OAuth can use IMAP in the near future.
Zoning regulations are today's import tariffs
I can write that with 2 lines of basic with print and goto. It also has the word Developers a few times.
Or they could have maybe lead with that sentence and THEN given the explanation.

Too many tech people have that "I want to slowly lead you to the point like Sherlock Holmes mystery" style of writing, and it is such a time-waste. Arthur Conan Doyle was paid by the word, you aren't. Please, everyone, back to middle school: State a Thesis in your first sentence and THEN expand on it, don't force me to spend pages trying to figure it out.
Please add remaining-characters-counters. I understand that the site needs to limit the amount of text a submitter can post, but it is very frustrating when textarea just refuses my inputs. The UX is horrible. If there was a tiny counter (like all proper SMS apps have), then, the cutoff would be expected and expectations set straight even before we start typing. Thanks!
Show HN: Leverage noncompete ban with competitor monitoring
I never thought of ProtonMail as a secure-from-state-surveillance provider. Only as a secure-from-civil-surveillance-aparatus provider. A replacement for Gmail, no more than that.

If I wanted to conduct illegal activities I would not use my main account on it, at minimum.

Protonmail is a step up from Gmail/Outlook, but no more than that. You need more layers on top of it.
The Conspiracy Against the Human Race by Thomas Ligotti: a good introduction to radical pessimism. If you get into it, it's a good idea to move on to Eugene Thacker, whose writing is deeper and less polemical.

Fear and Loathing on the Campaign Trail 1972 by Hunter S. Thompson: gives a better understanding of the political contexts that led to our current politics. Somehow, we keep re-living this election over and over again.
Lumenaza: The software company powering the green distributed energy world
On the other hand, it is fairly easy to obtain an ip, change your config to static ip reusing same ip, then and only then connect to the VPN.
Ever wondered why Python is the go-to language for Artificial Intelligence (AI) and Machine Learning (ML)? Look no further! Python's charm lies in its simplicity and rich ecosystem of Python modules and frameworks. This dynamic duo empowers even beginners to jumpstart their AI/ML journey.
> But the reason for that change is again precisely to make sure everybody has some representation. For instance, rolling with the Norway theme, here is a list of their political parties currently with representation in Parliament.

I put it to you that the different voting system of PR for the Storting is far more important in ensuring that outcome rather than speech.

As do a few other things; the state broadcaster rather than a set of increasingly weird private clickbait conspiracy broadcasters as in the US; the monarchy; and having Vikrund Quisling taken out and shot.
What if you change or lose your phone?
> Please just write out your imports, it doesn't take that long.

I have to disagree with that; add debug fmt.Println() → add fmt import. Okay, found it, so remove debug → remove fmt import. Okay so the problem was that we need to use filepath.EvalSymlinks() → add path/filepath import. Wait, that still didn't work; let's add back that debug Println()... etc. etc.

Other people may have other dev cycles, but I hugely miss it when it's not available (I sometimes do some work on VMs for cross-platform work where this is the case).

Same with gofmt really; these days much of the time I just write:

if foo==bar{fun()}else{panic("oh noes")}

And let gofmt sort it out.

Of course I can write all the spaces and whatnot but why bother?

I do agree the whole package shadow thing is a right pain.
Nondiscrimination on the Basis of Disability; Accessibility of Web Information
You seem to be conflating routing and firewalling/access control.

You can control your routing table using standard tools (ip route add). You can have helper applications work on it, and get hints from external sources like dhcp, where you can listen to its suggestions (IP, subnet, DNS, extra routes, and other options), or ignore them.

If you take those hints then that's your choice.

With icmp redirects you can choose to allow them or not with settings like net.ipv4.conf.all.accept_redirects.

Then as a belt and braces you have iptables. If you want an ACL on the network interface to say "DENY all traffic except from VPN application", then set your input/output/forward chains to default deny and have a rule to allow from pid=$vpn_pid. I believe you can use pid in pre/postrouting chains.

Personally when I'm travelling I have rules which only allow access to my vpn targets, and from memory just DHCP and arp. Have to temporarily disable it for captive portals but then it's back on. Sometimes a network won't accept UDP, so I generally have to tether for normal response.
Show HN: Blog to Video
Hey guys, I had a quite overgrown video gen python tool that used gpt, dalle, mj (the initial reason I created mjapi.io), then someone on reddit asked me if I could create a barebones blog-to-vid tool for him, he'd pay 1k for a 2y license. which sparkled my imagination.

Since I already had all the fancy stuff in place, most notably the moviepy pipeline (transitions and all that stuff), I said sure, let me repurpose my current tool (I actually duplicated the project, in case I'd need to continue the old one later).

The way it works is:

1. either enter an article's url or skip to get a template script (better use the 2nd option first, as the template doubles as documentation)

2. edit the script to your liking, adding external image urls in the form of "name=url", then referencing them at the beginning of each paragraph as "<name>". this is a made-up markup syntax I invented just for this purpose, to be maximally visual within the bounds of this app. ofc, a 'fancy-pants' editor with buttons and sliders is on the way

3. optionally upload 2-3 mins of your voice, wait for it to process (no progress bar), then you can select it from the dropdown

4. choose render settings and press render. if it takes a long time, just wait, there's just 1 worker behind the scenes (but I can easily spin up more if needed, just lmk)

stuff I've learned:

- django is goat if you're proactive in python; it also sucks if you want to test it on different machines without https

- swagger is AMAZING

- front-end devs are underrated; I'm really struggling with convincing my friend to help me with it :D all the backend and everything is ready to scale with any kind of demand, but front end is ages behind
It's incredibly brittle. The more frequented a network is the shorter the DHCP leases will be, I've seen public hotspots with 10 minutes of lease time.
Has the LTO bug affecting Ceph client been fixed in this? I don't see a mention of this ticket in the changelog, but in the issue itself it sounds like they managed to resolve it: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113359
Good article. It's really obnoxious that so many websites now offer you probablistic results when you're actually searching for some well defined thing you asked for in precise terms. Getting some ML suggestion should be an optional fallback if I can't articulate what I want, not a first choice.

Youtube isn't mentioned in the piece but it's also one of the worst offenders of this. They shove so much "do you want to see this again?" or "for you" in the middle of your results it's crazy. Luckily using a search operator like ` after:[date]` still gets rid of it. I've noticed having to use operators on more and more sites to basically force them to not hand me random content back.
eh. I feel it misses the nuance.
'Blackstone has misled investors'
For RISC-V, it's extensions all the way down. The mandatory core is tiny and all the value (outside of minuscule microcontrollers) is in the extensions.

It makes more sense if you think about it like programming libraries. That's the same 'mess', but it's not a problem.

There is often fear of 'fragmentation', but vendors tend to be highly responsive to their target market and competitors for each application and will coalesce around a set of extensions that make sense.

The other thing I'd add is that the one thing worse than having 'yet another extension' is not having the extension you need. Extensions are a response to market demand.
Hey!

We were tired of spending 3+ hours researching our competitors, while we could do something more efficient, like re-watching Game of Thrones. That's why we built RivalSense - a competitor monitoring tool.

RivalSense aggregates data from 80+ public data sources and, using LLMs, provides you with curated weekly updates on your competitors. The insights are so easily digestible that you can review them even while sitting in the toilet.

Leverage the noncompete ban, get the best insights about your competitors, and be on top of the world!

Cheers
- Markuss
Ecosystem, which don't allow me to download track from my watches to smartphone when I don't have internet access...

I don't say, that Google is better, but Garmin is not so good :-(
So now chatgpt will become an even more obnoxious elitist "helper", telling you that you've asked a very basic question that even the most basic search query would have answered it. Go back and RTFM!
Sardina Systems Relaunches Its Partner Program
It would have been tough since the book and movie for 2001 were created concurrently.
What do you expect exactly? I'm sure every big tech has had AI in their products for a while now: Who do you think filters the spam in your Gmail, if not their AI Bots? Or the music suggestions in your Spotify?

Why do you think Microsoft would be a hellhole for doing the same? Especially considering all the productivity use cases they've shown for the Office suite.

I swear HN needs to hate everything Microsoft is doing just because.
Would isolating a Wireguard interface using namespaces as described here[0] mitigate this?

[0] https://www.wireguard.com/netns/#the-new-namespace-solution
Well, sure! They have many thousands of really smart developers.

I don’t think this particular doc, although it is a really good doc, supports the design doc process as described in the original article. It looks like good work being done in spite of the process, not because of it. It’s obviously just one data point, but I’d put it down as a negative point.

I wonder if anyone has done a proper investigation into whether the process is a good one?
SpaceX got the fanfare, but Boeing's first crew flight is still historic
This is the third case: creating value for employees. Google promotes people for making new things. Thereby guaranteeing product churn.

(edit: the limit case is of course Elon Musk arguing that he should simply be given the entire company treasury as payroll at Tesla, one single employee taking all the value produced)
It isn't though, at least not in the same way. It's not as if apps can't generate unique identifiers like a UUID. What's important for fingerprinting isn't that it's unique but that it's stable across different apps which this wouldn't be. You could maybe try to eek out a bit of information with "value is greater than" but it would be hard to orchestrate because you can't guarantee that all apps will be first used around the same time.
Java 21, naive implementation, javax.xml.stream.XMLStreamReader, 2015 MBP:

1.2s warm

1.6s cold
The difference between “I don’t have enough entropy” and “I have enough entropy to last until the heat death of the universe” is only a small factor.

Attack on the RNG state or entropy is much more of a risk. The entropy required is not a function of how much randomness you need to generate but how much time the system has been running.
i've been using my Fairphone 5 without any google account since last december, so about 5 months now i guess?

Not fully de-googled yet, not even a custom rom - just the stock OS, but not signing into an account. Most importantly, this means no Play Store for me - i get the majority of my apps from Obtainium (directly download + install APK releases from the app developer's source repository) and f-droid.

The apps i use most by far are messaging apps like Signal and Telegram which offer direct downloads and easy updating without play store, Organic maps for navigation, breezy weather, Immich (google photos replacement, self hosted) and etar (calendar, but its kinda clunky). oh and keepass2android-offline for my password managing needs, which is synced to my homeserver using Termux (linux running on android, with certain differences/limitations).

For sacrificed functionality: my bank's website works just fine on mobile browsers. for the 2 factor auth, it uses something called "Mobile ID", seemingly a standard different from sms or app-specific ones, i'm not sure how widely available it is but it works great for me. Chatgpt says it's used in a couple of European countries.
For buying public transport tickets, i used the website for a while, but in my country the website is kinda shitty compared to the mobile app, it takes like 15 clicks to get a ticket where on the app it's 3. so i went to apkmirror/apkpure (ad-infested websites that offer direct download of APKs without google acc) and got the app there - this is both a security risk and inconvenient, but in this case it works for me and i can buy tickets with the app without problems.
It's normal. Dropbox was derided on HN because it wasn't much more than a glorified FTP.
Isn't B2 cheaper for big volumes of data?
The big problem with these things is that the people responsible for the misery they cause will not feel any of the consequences.
If the housing market crashed in any meaningfully impactful wait there would be way bigger issues to worry about and you’d still only be in the same situation as a renter, maybe even still more well off.
Daily encrypted backup to Google Drive, like WhatsApp?
Using AI to predict GPA from college application essays
Gmail will clip emails if they’re larger than (I think) 104kb.

Using frameworks like mjml can add a lot of arbitrary markup that’ll rapidly increase the size of your email.
I doubt anything good will come out of it, probably some corporate enterprise thingie
Surely they all are.
Surely for the next while, no one takes the lead by more than an inch for more than a minute.
You should show an interview example with engineering questions then. The questions in your example interview are technician-level. Checking a mechanical drawing for consistency is not an engineering task - the job that does that is "design checker". Design checkers typically have associate's degrees in drafting or CAD operation. The DFM question is arguably engineering but it could be even better answered by a machinist.

Engineering questions do not have to be complex, but they are different in kind.
Survival of the Fattest
Just leave it
For HPC, there are two different contexts where users need to be considered - interactive use and batch job processing. Users login to a cluster, write their scripts, work with files, etc. This is your typical user account stuff. But they also submit jobs here.

Second, there are the jobs users submit. These are often executed on separate nodes and the usage is managed. Here you have both user and cgroup limits in place. The cgroups make sure that the jobs on have the required resources. The user authentication makes sure that the job can read/write data as the user. This was the user can work with their data on the interactive nodes.

So the two different systems have different rationales, and both are needed. It all depends on the context.
I bet there are hidden jews living in other muslim countries too. But that's not really the point. The point is the fear, intimidation, and murders.
Microoptimizing for what the cargo cult believes gets you promoted is strictly worse than microoptimizing for what actually gets you promoted.
ok, NYT clearly passes :-)
Probably should have made this comment 20-25 years ago but anyway. Always was impressed that with each new release that my application ran that bit faster on the same code, so thank you backend people (SPARC). Lots of fun to bootstrap too and compile the compiler and check it stays the same. Although to be fair bootstrapping Kermit from nothing was a more impressive process.
I tried to install, and discovered yet again why I fell out of love with Python.

Executing:

pip3 install -r requirements.txt

gave this error:

" Traceback (most recent call last):
File "/tmp/tmprhazpypn", line 126, in prepare_metadata_for_build_wheel
hook = backend.prepare_metadata_for_build_wheel
AttributeError: module 'sipbuild.api' has no attribute 'prepare_metadata_for_build_wheel'

...

ERROR: Command errored out with exit status 1: /usr/bin/python3 /tmp/tmprhazpypn prepare_metadata_for_build_wheel /tmp/tmpl72s0sfd Check the logs for full command output."

I'm on Linux Mint 19.
> Experts say close ties between TikTok and ByteDance call into question whether TikTok could be considered a separate entity, making a potential sale unfeasible.

Oh? All that needs selling is TikTok the product.
Purposefully Render-Blocking
Every dev here loves throwing unglamorous volunteer work to non-developers, acting as if it's a favor.
What, specifically, is the “secure browsing” that they offer and how does it improve on HTTP over modern TLS?

Funnelling your traffic through another entity doesn’t magically increase security.
What a weird comparison.
I had no idea how expensive owning a dog was. Vet and dog food prices have all shot up.

Before I used to say you should get a pet, now I don’t.

Same with kids. It’s insanely expensive to have kids.

You wanna stick it to P/E and capitalism? Reduce spending.

Live like you’re making half the income.
You don't get promo in your scenario either. A design doc for something that's trivial will be called out in promo packet review and not given much credence. If the packet is primarily comprised of such artifacts the promo will be denied.
Ask HN: What does the blue team in agencies look like?
Considering the sensitivity of the topic, I'm not expecting any specific answer.

In fact, I'm just curious in two questions:

Would you actually install an alarm in the office?

Do foreign agencies clash with you 24\7?

Thanks for any insight.
User privacy. Keeps the data on the phone.

Speed. Fit warehoused and brokered data centrally via OAuth which is far slower a local-local system API integration.

https://developer.android.com/health-and-fitness/guides/heal...

I think this is a much better design for this perimedical data, but it's absolutely going to be harder to do some things now you have to interact directly with a device API.
How timely. I was just trying to figure out how Webviews handled browser notifications yesterday (they don't which is obvious in hindsight I guess). That one doesn't yet resolve on this site, but I've bookmarked it
There is a line of thought that the more value you give a customer the less your company will keep for itself and the less a shareholder will make. A volunteer gives away all their value to the recipient. An entrepreneur wants to collect money in exchange for value created. Far more money than they spent creating the value for the customer.
I'm responding to the only form of your argument here.
"doesn’t make him bad"

Doesn't it though?
Things like malloc_usable_size() exist but you're not supposed to use the overage it tells you about so they're not very useful APIs.
Quite honestly, people have no business sending me code to execute or resources to fetch.

I get that adtech is interested in using my email as their billboard, but they can fuck right off. Plaintext + attachments or gtfo.
I came looking for this and was not disappointed. (Though I also appreciate that the top comment is more thoughtful, a credit to HN's priorities.)
Time-based One-Time Password (RFC 6238).
Also, the people making money off ads don’t have a lot of interest in someone paying some money, and then never seeing anymore ads again. They are in fact incentivised to continue the “ad supported is the only way” paradigm.
This is a pet theory borne of no research at all, but from my fiddling around with Go I feel like this is a necessary feature for one reason:

Go will refuse to compile if you have unused imports.

When I'd be playing around trying to get things to work, the import management thing was a lifesaver, I'd delete a line of code that was only a temporary exploration and its imports would disappear, I'd write something similar and the tool would add the imports back again. The annoyance of having to add them back constantly or always make sure there was some dummy "use" somewhere or manually comment them out and back in every time would be incredible to me.

It seems like it would be a lot better to simply warn on used imports and maybe refuse in release mode, but Go apparently thinks religious purity in one aspect is worth the price of making standard tooling remarkably lax in another?
Matlab has the issue of not being open source (similarly IDL), but I still see it popping up (though naturally, if I've got any choice it the matter, it's going to be ported to Python). I've also seen new Fortran codebases as well, mainly where the (conceptual, not computational) overhead of using helper libraries isn't worth it.

I'd suggest Python (via the various memoryview related PEPs, plus numpy) does provide most of the required information (vs. e.g. Go or Rust or Ruby), so I'm not sure that proving much other than if the value of using a library to handle multidimensional arrays is enough such that the combined value of a more general language plus library beats Matlab or Fortran (likely due to other ecosystem or licensing effects), people will switch.
I am Jacks endless disappointment.
j/k - it looks nice - how would you compare/position it against something like jupyter lab?
It worked. Win 10 Pro is installed.
You must also detect "too long loops"… which is dangerously close to solving the halting problem.
I think what you're saying is that the problem which was once easily diagnosable from an incorrect import may now become much more difficult to diagnose from an incorrect interface implementation. I think that is somewhat valid in a technical sense but a lot less likely to occur in practice, because most people will use the package-level functions which are guaranteed to use the CSPRNG.
I can confidently predict that no technological advancement will bring us into that utopia. With our current level of tech, we could easily be there now. At this point we don't need engineering technology, we need social/political/economic reform.